| 1. | The Future of CSS(joshwcomeau.com) |
| 601 points by soheilpro 4 days ago | 263 comments | permalink | |
tl;dr: Browser vendors are planning Interop 2027, and Mozilla is letting developers upvote CSS features to prioritize. Top candidates include CSS `@function` definitions, `corner-shape`/`border-shape` for squircles and custom borders, Level 2 Anchor Positioning, scroll-triggered animations, `reading-flow` for accessible tab order, `interpolate-size` for animating to `auto`, gap decorations for grid borders, and sticky/scroll-state container queries. Most are already shipping in Chromium and usable today as progressive enhancements. | |
HN Discussion:
| |
| 2. | Upcoming critical PHP security release (CVE-2026-109618 / -109619)(news-web.php.net) |
| 1514 points by xd 5 days ago | 650 comments | permalink | |
tl;dr: Summary not available | |
HN Discussion:
| |
| 3. | Show HN: SimCity, but with Permits(permit.petercai.com) |
| 909 points by pcai 5 days ago | 410 comments | permalink | |
tl;dr: Permit Pending is a free browser-based city simulation where you play an elected mayor rather than an omnipotent builder, navigating zoning hearings, appeals, lawsuits, and reelection campaigns to get anything built. Every improvement creates opposition—new housing angers homeowners, industry brings smog complaints—and the underlying economy tracks residents, businesses, rents, and jobs while your projects languish in committee. It's a sandbox with no win condition: the goal is simply to stay in office long enough to shape the city you want. | |
HN Discussion:
| |
| 4. | Voxtral 3(mistral.ai) |
| 760 points by ilreb 5 days ago | 197 comments | permalink | |
tl;dr: Mistral has released Voxtral 3, a family of speech-to-text and text-to-speech models paired with a LiveKit-based voice agent SDK that unifies listening, reasoning, tool-calling, and speaking into a sub-second streaming pipeline. The models claim state-of-the-art multilingual transcription (50+ languages), diarization, and context biasing, beating Whisper, Gemini 3.5 Transcribe, and Scribe v2 on benchmarks, with TTS supporting 35+ languages and voice cloning from 30 minutes of audio. Pricing starts at $0.0035/min for batch transcription and $13/1M chars for TTS, available via EU-hosted API or self-deployment. | |
HN Discussion:
| |
| 5. | eMudhra intermediate CA compromise(emudhra.we-have-a-problem.com) |
| 1206 points by galadran 5 days ago | 478 comments | permalink | |
tl;dr: Private keys for eight eMudhra intermediate CA certificates were compromised due to flawed key generation, allowing anyone to recover them from the certificates issued since April 2025. The affected intermediates chain to roots trusted by Mozilla, Microsoft, Apple, and Chrome, all of which have pushed revocations; however, non-browser clients that don't enforce Certificate Transparency or consume revocation data remain vulnerable until software updates (ca-certificates, curl, Go, Node, etc.) are applied. The page provides verification tools and manual workarounds for macOS, Linux, and BSD systems. | |
HN Discussion:
| |
| 6. | Feds suspect ransom negotiator ran ShinyHunters extortion site(krebsonsecurity.com) |
| 264 points by Bender 5 days ago | 138 comments | permalink | |
tl;dr: Federal investigators probing the ShinyHunters extortion group—which recently breached the FBI's recruitment site—believe executives at two ransomware negotiation firms had suspiciously close ties with the hackers, with one US executive allegedly helping operate the group's victim-shaming site "shinywire.com." Canadian cybersecurity executive Edward Dubrovsky was already arrested in October, and chat logs from arrested ShinyHunters member Pepijn van der Stap reportedly show negotiators knew about breaches before victims did. The case highlights conflicts of interest in an industry where negotiators often take a percentage of ransom payments, incentivizing larger payouts. | |
HN Discussion:
| |
| 7. | Google open-sources TorchTPU, a native PyTorch back end for TPUs(github.com) |
| 376 points by ilreb 5 days ago | 89 comments | permalink | |
tl;dr: Google has open-sourced TorchTPU, a native PyTorch backend for TPUs that provides custom ATen kernel implementations, a compilation cache for XLA computations, and support for data and tensor parallelism. It integrates with torch.compile() for graph-mode execution and ships with examples for models like Llama, Qwen, ResNet, and minGPT. Available via pip (torch_tpu 0.2.0) or buildable from source with Bazel, requiring Python 3.11+. | |
HN Discussion:
| |
| 8. | What shall I teach my son?(stevekrouse.com) |
| 473 points by Curiositry 5 days ago | 622 comments | permalink | |
tl;dr: A soon-to-be father and programmer grapples with education's purpose as AI threatens the "earn a living" justification that quietly anchored his worldview. Drawing on Neil Postman's The End of Education, he notes schools have outlasted repeated predictions of their demise (radio, MOOCs, etc.) because their real purposes are subtler than stated ones. His tentative conclusion: invent new purposes collaboratively with children rather than imposing them, since how we teach matters more than what. | |
HN Discussion:
| |
| 9. | SlopCodeBench 10/2026 – Opus 5.5, Astra wins overall, xhigh considered harmful(github.com) |
| 304 points by dhorthy 10 days ago | 120 comments | permalink | |
tl;dr: On the full 36-problem SlopCodeBench, GPT-6 Astra XHigh led strict pass rate at 16.3%, narrowly beating GPT-6.1 SOL Medium (14.8%) and Opus 5.5 Medium (14.3%), while Opus 5.5 Medium topped the looser "core" rate at 74%. Higher reasoning effort (XHigh) cost 2-4x more but didn't reliably improve strict scores—Opus 5.5 actually did worse on XHigh than Medium, though its XHigh output was ~5x cleaner by slop metrics. Models still routinely break regression tests as requirements evolve, with only 0-3 of 36 final checkpoints passing strictly. | |
HN Discussion:
| |
| 10. | Apple broke an essential presentation feature of iPads(teddysvoronos.com) |
| 598 points by evanb 5 days ago | 293 comments | permalink | |
tl;dr: iPadOS 27 broke a key presentation workflow: when AirPlaying, tapping any app other than the presenting one now mirrors the entire iPad screen to the external display, exposing private notes, poll results, or presenter views. This affects GoodNotes, Keynote, and PowerPoint differently, but all are disruptive—Keynote exits presentations entirely, while PowerPoint enters a broken state requiring a restart. The author proposes that apps in presenter mode should retain external display precedence until explicitly stopped, and has filed feedback with Apple (FB23615646). | |
HN Discussion:
| |
| 11. | DeepInfer: High-performance inference framework for DeepSeek models(github.com) |
| 2303 points by ggcr 5 days ago | 884 comments | permalink | |
tl;dr: DeepSeek has open-sourced DeepInfer, the inference framework powering its production services, built on vLLM with influences from SGLang and TensorRT-LLM. It supports DeepSeek-V4.1-Flash on NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs, featuring optimized kernels (FlashMLA, DeepGEMM), speculative decoding with confidence-scheduled verification, batch-invariant and deterministic inference, async scheduling, and structured outputs. The release covers offline inference only—a KV cache system, prefill/decode disaggregation, and load balancing are required but not included for a full serving stack. | |
HN Discussion:
| |
| 12. | Ofcom concedes defeat in 4chan case(prestonbyrne.com) |
| 416 points by iamnothere 5 days ago | 407 comments | permalink | |
tl;dr: Ofcom has effectively conceded it cannot enforce Online Safety Act fines against 4chan, acknowledging in parliamentary testimony that foreign courts can block recovery—a direct consequence of dicta in 4chan v. Ofcom suggesting US courts would refuse to enforce such judgments on First Amendment grounds. The author, 4chan's lawyer, argues this vindicates proposed US legislation (the GRANITE and HOMEFRONT Acts) to strip sovereign immunity from foreign censors. Ofcom is expected to next seek unilateral UK site-blocking powers from Parliament, which the author notes would be easily circumvented via VPN. | |
HN Discussion:
| |
| 13. | Sixteen years after Deepwater Horizon, deep sea life shows few signs of recovery(e360.yale.edu) |
| 318 points by speckx 5 days ago | 187 comments | permalink | |
tl;dr: A new PNAS study finds that deep-sea populations of octopus, squid, krill, shrimp, and lanternfish in the Gulf of Mexico dropped by at least 60% after the 2010 Deepwater Horizon spill and have shown little recovery 16 years later. Researchers also detected reduced genetic diversity and found oil-related compounds in deep-sea species, which can impair reproduction and development. While not definitively proven, the spill is described as "the most parsimonious explanation" for what they call the fastest, most severe decline ever documented in this ocean layer. | |
HN Discussion:
| |
| 14. | Tsrs: A Port of TypeScript to Rust(blog.cloudflare.com) |
| 429 points by hnisjafx40 5 days ago | 211 comments | permalink | |
tl;dr: Cloudflare, VoidZero, and Owner.com are developing tsrs, a Rust port of the TypeScript compiler, in collaboration with the TypeScript team as part of the Oxc toolchain. Early benchmarks show tsrs is up to 8x faster and uses ~70% less memory than TypeScript 7.0, with Rust chosen primarily for its superior WebAssembly story (no GC overhead), enabling sandboxed dev environments in browsers, Workers, and embedded devices. The project aims to stay faithful to upstream TypeScript rather than fork it, using agents to track and sync changes similar to their Vinext/Next.js workflow. | |
HN Discussion:
| |
| 15. | How I got over 300 Tor exit nodes removed(kaba.cx) |
| 395 points by kabakabakaba 5 days ago | 101 comments | permalink | |
tl;dr: A researcher discovered that ~333 Tor exit nodes (roughly 10% of the network) had been compromised with the Ebury OpenSSH backdoor and were coordinating to intercept unencrypted mail traffic and MITM SSH connections on port 22. Using exitmap to script test SSH connections between two of his own servers, he detected which exits were redirecting traffic to 12 interception servers, then reported findings to the Tor Project, which flagged the relays as BadExit within days. The origin of the initial server compromise remains unknown, with speculation pointing to a possible hosting provider breach. | |
HN Discussion:
| |
| 16. | Academics have a duty to defend open knowledge systems like Wikipedia(blogs.lse.ac.uk) |
| 227 points by jruohonen 5 days ago | 150 comments | permalink | |
tl;dr: Generative AI tools like ChatGPT and Gemini are siphoning readers from Wikipedia while simultaneously scraping its content for training, threatening the volunteer community that sustains it. The author argues academics have an ethical duty to defend Wikipedia by contributing expertise, citing it in scholarly work, and teaching students to edit it—noting that Wiki Education programs already supply roughly 19% of new active editors. For this to work, universities must formally recognize Wikipedia contributions as legitimate public service in tenure and evaluation processes. | |
HN Discussion:
| |
| 17. | Publish fake stats, get cited in LLMs(peec.ai) |
| 363 points by robtherobber 5 days ago | 202 comments | permalink | |
tl;dr: An experimenter spun up a site with 50,000 fabricated statistics using GPT-4.1 for about $50. Google deindexed it after two updates, but ChatGPT kept retrieving it heavily—driving 10,000+ sessions, 330+ referring domains (including Shopify, DHL, Bluehost), and citations in an academic paper and a Qatari bank's investment research. The takeaway: LLM retrieval operates independently of Google rankings, models prefer specific numbers to fill gaps without fact-checking, and citation laundering can make fabricated stats appear authoritative over time. | |
HN Discussion:
| |
| 18. | Facebook Pages require paid subscription to post more than two links per month(mastodon.gamedev.place) |
| 460 points by AshleysBrain 5 days ago | 401 comments | permalink | |
tl;dr: Summary not available | |
HN Discussion:
| |
| 19. | An ad-free Android TV(cretezy.com) |
| 434 points by CraftThatBlock 6 days ago | 190 comments | permalink | |
tl;dr: The author details an ADB-based setup to strip ads from Android TV: replacing Google TV's launcher with Projectivy, swapping YouTube for SmartTube, using Wholphin for Jellyfin, and remapping the remote with Button Mapper. Additional steps cover disabling the stock launcher and bloatware packages, plus using Pi-hole or AdGuard DNS to block the home-screen banner and tracking across the network. | |
HN Discussion:
| |
| 20. | Google Cloud outage affects almost all banking and other operations in Europe(neowin.net) |
| 401 points by paweladamczuk 5 days ago | 204 comments | permalink | |
tl;dr: Summary not available | |
HN Discussion:
| |